HHS’ Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.

Settlement Marks OCR’s 56^th HIPAA Right of Access Enforcement Action to Advance Individual Access to Medical Records

WASHINGTON — October 8th, 2026 — The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a settlement with Linda L. Shen d/b/a Shen Smiles, P.C. (Shen Smiles), a Pennsylvania-based healthcare provider that offers dental services, for potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule. The settlement resolves an investigation of a complaint alleging a failure to provide timely access to an individual’s protected health information (PHI).

“The Privacy Rule’s administrative requirements are essential to protect not only PHI from impermissible use or disclosure, but also to ensure that covered entities are able to meet their obligations related to individual rights, such as the right of access,” said OCR Director Paula M. Stannard.

OCR initiated an investigation after receiving a complaint that Shen Smiles failed to provide an individual with timely access to her PHI despite receiving multiple requests. During OCR’s investigation, Shen Smiles asserted that it could not provide the individual with access to her PHI because a workforce member stole the records from the practice. OCR’s investigation determined that Shen Smiles failed to implement policies and procedures with respect to PHI that are designed to comply with the Privacy and Breach Notification Rules, including a failure to have right of access policies and procedures, and that Shen Smiles did not reasonably safeguard PHI from any intentional or unintentional use or disclosure that would violate the requirements of the Privacy Rule.

On July 31, 2024, OCR issued a Notice of Proposed Determination proposing to impose a civil money penalty, and Shen Smiles subsequently requested a hearing before an administrative law judge. On August 11, 2026, prior to an administrative hearing, OCR and Shen Smiles resolved this enforcement action with a resolution agreement. Under the terms of the resolution agreement, Shen Smiles agreed to pay $140,000 to OCR.

The HIPAA Privacy Rule’s “Right of Access” provisions require that individuals, or their personal representatives, have timely access to health information within 30 days, with the possibility of one 30-day extension. OCR enforces the HIPAA Privacy Rule, which establishes national standards to protect individuals’ health records; sets limits and conditions on the uses and disclosures of PHI; and gives individuals certain rights, including the right to timely access and to obtain a copy of their health records for a reasonable cost.

The Notice of Proposed Determination may be found here.

The Resolution Agreement may be found here.

OCR is committed to enforcing the HIPAA Rules that protect the privacy and security of people’s health information. Guidance about the Privacy Rule, Security Rule, and Breach Notification Rule can be found on OCR’s website.

If you believe that your or another person’s health information privacy, civil rights, or conscience rights have been violated, you can file a complaint with OCR.

Follow HHS OCR on X at @HHSOCR.